Analyst20723h ago

CISA Mandates Emergency Patch for Exploited Ivanti EPMM Flaw

The Cybersecurity and Infrastructure Security Agency (CISA) has issued a high-priority alert, ordering US government agencies to patch a critical vulnerability in Ivanti Endpoint Manager Mobile (EPMM) within just four days, as the flaw has been under active exploitation since January. With a Sunday deadline looming, federal IT…

https://osintsights.com/cisa-mandates-emergency-patch-for-exploited-ivanti-epmm-flaw?utm_source=mastodon&utm_medium=social

#IvantiEpmm #Cisa #EndpointSecurity #ExploitedVulnerability #EmergingThreats

CISA Mandates Emergency Patch for Exploited Ivanti EPMM Flaw

Patch Ivanti EPMM flaw now: CISA mandates emergency update for exploited vulnerability, secure systems within four days to prevent cyber attacks.

OSINTSights
 decioOct 9, 2025

La Zero Day Initiative a publié deux avis #0day concernant des vulnérabilités dans Ivanti Endpoint Manager :

ZDI-25-935 (CVSS 8.8) — RCE via Directory Traversal dans OnSaveToDB
Permet l’exécution de code arbitraire à distance.
⚠️ Exploitable via page/pièce jointe piégée — ou sans interaction si l’attaquant a des creds admin.
👇
https://www.zerodayinitiative.com/advisories/ZDI-25-935/

🧩 ZDI-25-947 (CVSS 7.8) — LPE via désérialisation non sécurisée dans AgentPortal
➡️ Permet une élévation de privilèges locale jusqu’à SYSTEM.
👇
https://www.zerodayinitiative.com/advisories/ZDI-25-947/

Le hic ?

Ivanti avait promis des patchs… d’abord pour septembre 2025, puis repoussés à mars 2026 (!)
Résultat : ZDI publie les détails en 0-day.

      🤦‍♂️

#CyberVeille #infosec #Ivanti #IvantiEPMM

ZDI-25-935

(0Day) Ivanti Endpoint Manager OnSaveToDB Directory Traversal Remote Code Execution Vulnerability

deltatux Aug 2, 2023
In a joint statement, Norway & the US confirmed that the malicious actors had access to the Government of Norway’s networks since April until it was discovered last week.

The attack stems of attackers breaking in through the Ivanti Endpoint Mobile Manager.

#infosec #cybersecurity #GovSec #Norway #IvantiEPMM

https://www.bnnbloomberg.ca/cyberattack-on-norway-ministries-lasted-at-least-four-months-1.1953844
Cyberattack on Norway Ministries Lasted at Least Four Months - BNN Bloomberg

A cyberattack on Norway’s government ministries uncovered last week had exploited a vulnerability linked to mobile device management and lasted at least four months, according to Norwegian and US cybersecurity agencies.

BNN